What is the CVSS score of CVE-2026-36874?

CVE-2026-36874 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-36874

EUVD-2026-21914 LOW

SQL Injection (CWE-89)

2026-04-13 mitre

GHSA-mj7r-43ff-7j6r

SQLi PHP

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:46 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

2.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 12:45 euvd

EUVD-2026-21914

Analysis Generated

Apr 13, 2026 - 12:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

LOW 2.7

DescriptionCVE.org

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_student.php.

AnalysisAI

SQL injection in Sourcecodester Basic Library System v1.0 at /librarysystem/load_student.php allows high-privilege authenticated attackers to read sensitive database information. The vulnerability requires administrative-level privileges and manual user interaction is absent, but real-world risk is minimal due to extremely low EPSS score (0.02%), CVSS severity of 2.7, and CISA SSVC assessment indicating no exploitation activity, non-automatable conditions, and only partial technical impact.

Technical ContextAI

The vulnerability resides in a PHP-based library management application where user-supplied input to the load_student.php script is improperly concatenated into SQL queries without parameterized statements or input validation, violating CWE-89 (SQL Injection) best practices. The affected product is a web application built in PHP, identified by generic CPE cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* in the Sourcecodester collection of educational code examples. The load_student.php endpoint likely processes requests to retrieve student records from a backend SQL database, and the injection point allows attackers to manipulate query logic by injecting SQL metacharacters into parameters.

RemediationAI

The primary remediation is to upgrade to a patched version of Sourcecodester Basic Library System if available; however, no vendor-released patch version is independently confirmed from available data. In the interim, implement parameterized queries (prepared statements) in the load_student.php script to eliminate SQL injection vectors-replace all string concatenation in SQL query construction with parameter binding (using mysqli_prepared_statements or PDO prepared statements). Input validation should be added as a defense-in-depth measure to whitelist expected student identifiers. If this is educational or legacy code not in active production use, the risk is further reduced. Administrative access controls should remain strictly enforced to limit who can access the vulnerable endpoint. Consult https://nvd.nist.gov/vuln/detail/CVE-2026-36874 and the GitHub bug report at https://github.com/Thirtypenny77/bug_report/blob/main/sourcecodester/basic-library-system/SQL-3.md for technical details.